Load Training Data¶

from xml_reader import XMLReader
import plotly.graph_objects as go
import plotly.offline as pyo
from rule_classifier import Analyzer

pyo.init_notebook_mode()

# read training data
input_data = [(i, XMLReader(f"Logs/Train/Person_{i}/Security.xml", f"Logs/Train/Person_{i}/Sysmon.xml")) for i in range(1, 7)]
analyzer = Analyzer(input_data)

Occurence¶

import json

for attr in analyzer.occurence:
    x = [label for label in analyzer.occurence[attr]]
    y = [analyzer.occurence[attr][label] for label in x]
    bar = go.Bar(name='occurence', x=[f'Person{label}' for label in x], y=y, text=[round(n,2) for n in y], textposition='auto')
    
    print(f"# {attr}")
    print(json.dumps(analyzer.occurence[attr], indent=4))
    
    fig = go.Figure(data=[bar])
    fig.update_layout(xaxis_type='category', title_text=attr, barmode='group')
    fig.show()

# system.EventID
{
    "1": 1.0,
    "2": 1.0,
    "3": 1.0,
    "4": 1.0,
    "5": 1.0,
    "6": 1.0
}

# event_data.ObjectType
{
    "1": 0.0020242914979757085,
    "2": 0,
    "3": 0.902600082542303,
    "4": 0,
    "5": 0.004036908881199538,
    "6": 0.001392757660167131
}

# event_data.TargetProcessId
{
    "1": 0,
    "2": 0.007936507936507936,
    "3": 0,
    "4": 0.049079754601226995,
    "5": 0,
    "6": 0
}

# event_data.Image
{
    "1": 0.8360323886639676,
    "2": 0.8869047619047619,
    "3": 0.07985967808501858,
    "4": 0.4279141104294479,
    "5": 0.5893886966551326,
    "6": 0.9345403899721448
}

# event_data.TargetUserName
{
    "1": 0.0931174089068826,
    "2": 0.041666666666666664,
    "3": 0.01011143210895584,
    "4": 0.05674846625766871,
    "5": 0.1707035755478662,
    "6": 0.01532033426183844
}

# event_data.TargetImage
{
    "1": 0,
    "2": 0.007936507936507936,
    "3": 0,
    "4": 0.049079754601226995,
    "5": 0,
    "6": 0
}

# event_data.NewThreadId
{
    "1": 0,
    "2": 0.007936507936507936,
    "3": 0,
    "4": 0.049079754601226995,
    "5": 0,
    "6": 0
}

# event_data.Hash
{
    "1": 0,
    "2": 0,
    "3": 0.0012381345439537762,
    "4": 0,
    "5": 0.006920415224913495,
    "6": 0
}

# event_data.ParentImage
{
    "1": 0.22469635627530365,
    "2": 0.3492063492063492,
    "3": 0.014857614527445316,
    "4": 0.10276073619631902,
    "5": 0.08823529411764706,
    "6": 0.0947075208913649
}

# event_data.ProviderName
{
    "1": 0,
    "2": 0,
    "3": 0,
    "4": 0.003067484662576687,
    "5": 0.002306805074971165,
    "6": 0
}

Composition¶

for attr in analyzer.statistics:
    bars = []
    if len(analyzer.value_dict[attr]) > 15:
        continue
        
    print(f"\n# {attr}")
    
    for label in analyzer.statistics[attr]:
        print(f"  - Person{label}:")
        print(f"\t{analyzer.statistics[attr][label]}")
              
        x = [n for n in analyzer.statistics[attr][label]]
        y = [analyzer.statistics[attr][label][n] for n in analyzer.statistics[attr][label]]
    
        bars.append(go.Bar(name=f'Person{label}', x=x, y=y))
    
    fig = go.Figure(data=bars)
    fig.update_layout(xaxis_type='category', title_text=attr, barmode='group')
    fig.show()

# event_data.ObjectType
  - Person1:
	{None: 493, 'File': 1}
  - Person2:
	{None: 0, 'File': 0}
  - Person3:
	{None: 472, 'File': 4374}
  - Person4:
	{None: 0, 'File': 0}
  - Person5:
	{None: 1727, 'File': 7}
  - Person6:
	{None: 717, 'File': 1}

# event_data.TargetProcessId
  - Person1:
	{None: 0, '544': 0, '536': 0}
  - Person2:
	{None: 500, '544': 4, '536': 0}
  - Person3:
	{None: 0, '544': 0, '536': 0}
  - Person4:
	{None: 620, '544': 0, '536': 32}
  - Person5:
	{None: 0, '544': 0, '536': 0}
  - Person6:
	{None: 0, '544': 0, '536': 0}

# event_data.TargetUserName
  - Person1:
	{'SYSTEM': 26, 'DWM-1': 0, 'Backup Operators': 0, 'WDAGUtilityAccount': 1, 'Administrator': 2, 'Administrators': 0, 'DefaultAccount': 1, None: 448, 'NS': 11, 'Guest': 5}
  - Person2:
	{'SYSTEM': 16, 'DWM-1': 0, 'Backup Operators': 0, 'WDAGUtilityAccount': 0, 'Administrator': 0, 'Administrators': 0, 'DefaultAccount': 0, None: 483, 'NS': 5, 'Guest': 0}
  - Person3:
	{'SYSTEM': 30, 'DWM-1': 0, 'Backup Operators': 5, 'WDAGUtilityAccount': 0, 'Administrator': 1, 'Administrators': 5, 'DefaultAccount': 0, None: 4797, 'NS': 4, 'Guest': 4}
  - Person4:
	{'SYSTEM': 25, 'DWM-1': 5, 'Backup Operators': 0, 'WDAGUtilityAccount': 0, 'Administrator': 1, 'Administrators': 0, 'DefaultAccount': 0, None: 615, 'NS': 2, 'Guest': 4}
  - Person5:
	{'SYSTEM': 40, 'DWM-1': 0, 'Backup Operators': 8, 'WDAGUtilityAccount': 56, 'Administrator': 57, 'Administrators': 8, 'DefaultAccount': 56, None: 1438, 'NS': 11, 'Guest': 60}
  - Person6:
	{'SYSTEM': 11, 'DWM-1': 0, 'Backup Operators': 0, 'WDAGUtilityAccount': 0, 'Administrator': 0, 'Administrators': 0, 'DefaultAccount': 0, None: 707, 'NS': 0, 'Guest': 0}

# event_data.TargetImage
  - Person1:
	{None: 0, 'C:\\Windows\\System32\\csrss.exe': 0}
  - Person2:
	{None: 500, 'C:\\Windows\\System32\\csrss.exe': 4}
  - Person3:
	{None: 0, 'C:\\Windows\\System32\\csrss.exe': 0}
  - Person4:
	{None: 620, 'C:\\Windows\\System32\\csrss.exe': 32}
  - Person5:
	{None: 0, 'C:\\Windows\\System32\\csrss.exe': 0}
  - Person6:
	{None: 0, 'C:\\Windows\\System32\\csrss.exe': 0}

# event_data.Hash
  - Person1:
	{'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, None: 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0}
  - Person2:
	{'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, None: 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0}
  - Person3:
	{'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 1, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 1, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, None: 4840, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 1, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 3}
  - Person4:
	{'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, None: 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0}
  - Person5:
	{'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 1, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 1, 'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 1, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 2, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 3, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 1, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 3, None: 1722, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0}
  - Person6:
	{'MD5=EFED1CD90742F6FCDDB8942DD21AC2AC,SHA256=F7D10A8020011B4D10C93F15B2526C63F9B4E4F793EB731CAB4B380D8AE6A313,IMPHASH=00000000000000000000000000000000': 0, 'MD5=5E732B01D021FEA585F0874407E6BE6C,SHA256=BCBBEAB9FDD35F9079A5E26A1E7156838364538B563A9B5DC1459F467D938CE2,IMPHASH=00000000000000000000000000000000': 0, 'MD5=6915F430B0C93840A1B3212B8F82F99A,SHA256=0AFB8A266A27B6A9B863D78A2B8087FA2D1CE5AB5B412B645B8377ABF2DD3E68,IMPHASH=00000000000000000000000000000000': 0, 'MD5=FBCCF14D504B7B2DBCB5A5BDA75BD93B,SHA256=EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913,IMPHASH=00000000000000000000000000000000': 0, 'MD5=BA446AFE6CE2341D9DDE43BD50DA7167,SHA256=E51CAD403CAFA19AE3D19B0B8B5F6AE61F7231047D8041CFF4CFED2F57D4100F,IMPHASH=00000000000000000000000000000000': 0, 'MD5=452373E2C467C14220EFEB10F40C231F,SHA256=E5EA9F5646FE3CFF2621B61A55A98EA5B3E9CA7DD7CC14C13535E55C88686872,IMPHASH=D7E2FD259780271687FFCA462B9E69B7': 0, 'MD5=D2E7685A60E27FA8408AC96336CA77A0,SHA256=E3E800946E4B1EE146F942CDFDA27B8C94B9DBABBDFD76B4515FB6BF00B9A888,IMPHASH=00000000000000000000000000000000': 0, 'MD5=56F6DC8E5B4D9F36F3F5732A5992E6A6,SHA256=8858955289BD86743B356DF90A8D45E608000973E66BE17CFBE9B70ADBD77209,IMPHASH=20DD26497880C05CAED9305B3C8B9109': 0, None: 0, 'MD5=C978088F04B0D519F04D76E76FB42CD4,SHA256=C4CFC46F50D9A051EEC3375C14E61CFE8B1A0290CAF16DC161B64828BC34CA2A,IMPHASH=00000000000000000000000000000000': 0, 'MD5=592ED72E3636996BE037E7A26B595895,SHA256=583E892750B46FA7AA6E62FC8A324E4F34D9A7263B9D90CC0229DEEDC900B382,IMPHASH=00000000000000000000000000000000': 0}

# event_data.ProviderName
  - Person1:
	{None: 0, 'Microsoft Software Key Storage Provider': 0}
  - Person2:
	{None: 0, 'Microsoft Software Key Storage Provider': 0}
  - Person3:
	{None: 0, 'Microsoft Software Key Storage Provider': 0}
  - Person4:
	{None: 650, 'Microsoft Software Key Storage Provider': 2}
  - Person5:
	{None: 1730, 'Microsoft Software Key Storage Provider': 4}
  - Person6:
	{None: 0, 'Microsoft Software Key Storage Provider': 0}

# event_data.IntegrityLevel
  - Person1:
	{'System': 69, 'Low': 1, 'Medium': 37, None: 383, 'High': 4}
  - Person2:
	{'System': 24, 'Low': 1, 'Medium': 148, None: 328, 'High': 3}
  - Person3:
	{'System': 42, 'Low': 1, 'Medium': 21, None: 4774, 'High': 8}
  - Person4:
	{'System': 24, 'Low': 0, 'Medium': 42, None: 585, 'High': 1}
  - Person5:
	{'System': 81, 'Low': 5, 'Medium': 60, None: 1581, 'High': 7}
  - Person6:
	{'System': 45, 'Low': 0, 'Medium': 17, None: 650, 'High': 6}

# system.Security.UserID
  - Person1:
	{None: 81, 'S-1-5-18': 413}
  - Person2:
	{None: 53, 'S-1-5-18': 451}
  - Person3:
	{None: 4459, 'S-1-5-18': 387}
  - Person4:
	{None: 341, 'S-1-5-18': 311}
  - Person5:
	{None: 712, 'S-1-5-18': 1022}
  - Person6:
	{None: 47, 'S-1-5-18': 671}

# event_data.QueryStatus
  - Person1:
	{'9002': 0, '9501': 1, '9852': 1, '123': 19, '1460': 1, '9701': 3, None: 371, '0': 98, '9003': 0}
  - Person2:
	{'9002': 0, '9501': 0, '9852': 0, '123': 11, '1460': 0, '9701': 0, None: 366, '0': 126, '9003': 1}
  - Person3:
	{'9002': 0, '9501': 0, '9852': 0, '123': 14, '1460': 0, '9701': 0, None: 4747, '0': 85, '9003': 0}
  - Person4:
	{'9002': 0, '9501': 0, '9852': 0, '123': 1, '1460': 0, '9701': 6, None: 509, '0': 134, '9003': 2}
  - Person5:
	{'9002': 0, '9501': 0, '9852': 0, '123': 17, '1460': 0, '9701': 0, None: 1643, '0': 71, '9003': 3}
  - Person6:
	{'9002': 1, '9501': 0, '9852': 0, '123': 14, '1460': 0, '9701': 0, None: 263, '0': 433, '9003': 7}

# event_data.AlgorithmName
  - Person1:
	{None: 0, 'RSA': 0, 'UNKNOWN': 0}
  - Person2:
	{None: 0, 'RSA': 0, 'UNKNOWN': 0}
  - Person3:
	{None: 0, 'RSA': 0, 'UNKNOWN': 0}
  - Person4:
	{None: 650, 'RSA': 1, 'UNKNOWN': 1}
  - Person5:
	{None: 1730, 'RSA': 2, 'UNKNOWN': 2}
  - Person6:
	{None: 0, 'RSA': 0, 'UNKNOWN': 0}